Senior Incident Response Consultant

Introduction

Information and data are among the most critical organisational assets in modern businesses. As a Senior Incident Response Consultant, you will act as a trusted advisor to IBM clients, analysing business requirements and delivering effective incident response and cyber security solutions. You will apply deep technical expertise to balance security and business enablement, supporting the continued growth of IBM's X-Force Incident Response practice, including the effective use of cloud-native and AI-enabled security capabilities.

Your role and responsibilities

As a Senior Incident Response Consultant within IBM X-Force Incident Response (X-Force IR), you will be responsible for the delivery and growth of X-Force IR services. You will lead teams responding to high-profile cyber security incidents across client enterprise environments and work closely with clients to prevent, detect, and respond to future incidents.

You will serve as a trusted advisor, helping clients to mature their incident response capabilities and broader cyber security programmes. The role requires close collaboration with internal IBM stakeholders to deliver integrated solutions to complex client challenges, including advisory support on modern, cloud-first security architectures.

You will demonstrate strong expertise across multiple aspects of incident response, including leading complex investigations, guiding less experienced consultants, and applying cyber security best practices across on-premises and cloud environments. You will be proficient with leading endpoint detection and response tools and forensic analysis platforms such as X-Ways. A strong understanding of Windows and Linux enterprise environments is required, including technologies such as Active Directory, Microsoft 365, firewalls, intrusion detection and prevention systems, security information and event management platforms, and cloud-native identity and logging services.

When not actively responding to incidents, you will conduct enterprise threat hunting, support the development and review of incident response plans, facilitate technical and executive-level tabletop and purple team exercises, and deliver additional strategic services aligned to incident response and cyber resilience, including guidance on the use of AI-driven detection and investigation capabilities.

Excellent written and verbal communication skills are essential.

The role includes participation in an on-call rota to support incident response engagements outside of standard business hours. On-call responsibilities are shared across the team and managed to support sustainable working practices.

Required education

Bachelor's Degree

Required technical and professional expertise

General Experience
• Significant hands-on experience with tools used in incident response, digital forensics, network security assessments, and or application security

• At least two years' experience assessing and developing enterprise-wide policies and procedures for IT risk mitigation and incident response

• Proven experience leading incident response engagements across all phases of an investigation

• Experience managing and mentoring consultants with comparable technical skill sets

• Ability to work independently while providing leadership on internal initiatives and client engagements
Forensic Analysis and Incident Response
• Ability to perform forensic analysis on Windows and Unix systems to identify evidence of compromise

• Proficiency with industry-standard forensic tools, including X-Ways and EnCase

• Experience performing log analysis both locally and through SIEM or log aggregation platforms, including cloud-native and AI-assisted analytics, particularly Splunk or ELK

• Experience conducting threat hunting activities in large enterprise and cloud environments

• Hands-on experience deploying, configuring, and using endpoint detection and response tools

• Strong understanding of common network protocols, associated security risks, and control mechanisms

• Familiarity with enterprise Windows and Linux applications, including Active Directory, Exchange, and Microsoft 365, as well as associated logging sources

• Knowledge of tools and techniques used to analyse and reverse network protocols, authentication flows, and data flows across enterprise and cloud environments

• Experience working with major cloud platforms, including IBM Cloud, AWS, Google Cloud Platform, or Microsoft Azure

• Ability to produce clear, structured reports for both technical and non-technical audiences
Strategic Assessment, Automation, and AI
• Review and analyse client policies, processes, and procedures to identify gaps at strategic and tactical levels, and provide recommendations to mature incident response capabilities and overall cyber security posture

• Strong familiarity with security frameworks and standards, including ISO 27001 and 27002, PCI DSS, NIST 800-53, NIST 800-171, and relevant data protection and privacy regulations

• Demonstrated experience planning, scoping, and delivering technical and executive-level tabletop exercises focused on incident response

• Ability to incorporate current threat trends and develop bespoke scenarios relevant to client environments

• Low-level operating system knowledge, including automation and administrative task execution